IP for 3G - (P2)

IP for 3G - (P2)

An Introduction to 3G Networks
Introduction
What exactly are 3G networks? 3G is short for Third Generation (Mobile System). Here is a quick run-down: † 1G, or ﬁrst generation systems, were analogue and offered only a voice service – each country used a different system, in the UK TACS (Total Access Communications System) was introduced in 1980. 1G systems were not spectrally efﬁcient, were very insecure against eavesdroppers, and offered no roaming possibilities (no use on holidays abroad.)....

Nội dung Text: IP for 3G - (P2)

IP for 3G: Networking Technologies for Mobile Communications
Authored by Dave Wisely, Phil Eardley, Louise Burness
Copyright q 2002 John Wiley & Sons, Ltd
ISBNs: 0-471-48697-3 (Hardback); 0-470-84779-4 (Electronic)
2
An Introduction to 3G Networks
2.1 Introduction
What exactly are 3G networks? 3G is short for Third Generation (Mobile
System). Here is a quick run-down:
† 1G, or ﬁrst generation systems, were analogue and offered only a voice
service – each country used a different system, in the UK TACS (Total
Access Communications System) was introduced in 1980. 1G systems
were not spectrally efﬁcient, were very insecure against eavesdroppers,
and offered no roaming possibilities (no use on holidays abroad.).
† 2G heralded a digital voice and messaging service, offered encrypted
transmissions, and was more spectrally efﬁcient that 1G. GSM (Global
System for Mobile communication) has become the dominant 2G stan-
dard and roaming is now possible between 1501 countries where GSM is
deployed.
† 3G – if the popular press is to be believed – will offer true broadband data:
video on demand, videophones, and high bandwidth games will all be
available soon. 3G systems differ from the second generation voice and
text messaging services that everybody is familiar with in terms of both the
bandwidth and data capabilities that they will offer. 3G systems are due to
be rolled out across the globe between 2002 and 2006. 3G will use a new
spectrum around 2 GHz, and the licences to operate 3G services in this
spectrum have recently hit the headlines because of the huge amounts of
money paid for licences by operators in the UK and Germany (£50 billion
or so). Other countries have raised less or given away licences in so-called
‘beauty contests’ of potential operators [1].
3G systems might be deﬁned by: the type of air interface, the spectrum
used, the bandwidths that the user sees, or the services offered. All have been
used as 3G deﬁnitions at some point in time. In the ﬁrst wave of deployment,
there will be only two ﬂavours of 3G – known as UMTS (developed and
promoted by Europe and Japan) and cdma2000 (developed and promoted

22 AN INTRODUCTION TO 3G NETWORKS
by North America). Both are tightly integrated systems that specify the entire
system – from the air interface to the services offered. Although each has a
different air interface and network design, they will offer users broadly the
same services of voice, video, and fast Internet access.
3G (and indeed existing second generation systems such as GSM) systems
can be divided very crudely into three (network) parts: the air interface, the
radio access network, and the core network. The air interface is the technol-
ogy of the radio hop from the terminal to the base station. The core network
links the switches/routers together and extends to a gateway linking to the
wider Internet or public ﬁxed telephone network. The Radio Access Network
(RAN) is the ‘glue’ that links the core network to the base stations and deals
with most of the consequences of the terminal’s mobility.
This chapter concerns the core and access networks of 3G systems –
because that is where IP (a network protocol) could make a difference to
the performance and architecture of a 3G network. The chapter ﬁrst reviews
the history of 3G developments – from their ‘conception’ in the late 1980s,
through their birth in the late 1990s, to the teething troubles that they are
currently experiencing. The history of 3G development shows that the
concepts of 3G evolved signiﬁcantly as the responsibility for its development
moved from research to standardisation – shedding light on why 3G systems
are deigned the way they are. Included in this section is also a ‘who’s who’ of
the standards world – a very large number of groups, agencies, and fora have
been, and still are, involved in the mobile industry. In the second half of the
chapter, we introduce the architecture of UMTS (the European/Japanese 3G
system) and look at how the main functional components – QoS, mobility
management, security, transport and network management – are provided. A
short section on the US cdma2000 3G system is also included at the end of
the chapter.
The purpose of this chapter is to highlight the way UMTS (as an example
3G system) works at a network level – in terms of mobility management, call
control, security, and so forth. This is intended as a contrast with the descrip-
tions of how IP research is evolving to tackle these functions in the chapters
that follow. The ﬁnal chapter combines the two halves – IP and 3G – to
pursue the main argument of the book – that 3G should adopt IP design
principles, architectures and protocols – thereby allowing greater efﬁciency,
ﬁxed mobile convergence, and new IP services (e.g. multicast).
2.2 Mobile Standards
Mobile system development, particularly that of 3G systems, is inextricably
bound up with the process of standardisation. Why? Why is standardisation
so important? The best answer to that question is probably to look at GSM –
whose success could reasonably be described as the reason for the vast
interest and sums of money related to 3G. GSM was conceived in the

MOBILE STANDARDS 23
mid-1980s – just as the ﬁrst analogue cellular mobile systems were being
marketed. These analogue systems were expensive and insecure (easy to
tap), and there was no interworking between the great variety of different
systems (referred to as ‘ﬁrst generation systems’) deployed around the world.
GSM introduced digital transmission that was secure and made more efﬁ-
cient use of the available spectrum. What GSM offered was a tight standard
that allowed great economies of scale and competitive procurement. Opera-
tors were able to source base stations, handsets, and network equipment
from a variety of suppliers, and handsets could be used anywhere the GSM
standard was adopted. The price of handsets and transmission equipment fell
much faster than general tends in the electronics industry. GSM also offered a
roaming capability – since the handsets could be used on any GSM system;
made possible by a remote authentication facility to the home network.
There were other advantages of moving to a digital service, such as a greater
spectral efﬁciency and security, but in the end, it was the mass-market low
cost (pre-pay packages have sold for as little as £20) that was the great
triumph of GSM standardisation. In terms of world markets, GSM now
accounts for over 60% of all second generation systems and has 600 million
users in 150 countries; no other system has more than 12% [2].
However, the standardisation process has taken a very long time – 18
years from conception (1980) to signiﬁcant penetration (say 1998). It has
resulted in a system that is highly optimised and integrated for delivering
mobile voice services and is somewhat difﬁcult to upgrade. As an example,
consider e-mail: e-mail has been in popular use since, maybe, 1992 but 10
years on, how many people can receive e-mail on their mobile? This facility
is beginning to appear – along with very limited web-style browsing on
mobiles [e.g. using WAP (Wireless Application Protocol) and i-mode in
Japan]. Standards can also be a victim of their own success – 2G (and
GSM in particular) has been so successful that operators and manufacturers
have been keen to capitalise on past investments and adopt an evolutionary
approach to the 3G core network.
2.2.1 Who’s who in 3G Standards
At this point, it is perhaps a good idea to provide a brief ‘who’s who’ to
explain recent developments in the standards arena.
† 3GPP – In December 1998, a group of ﬁve standards development orga-
nisations agreed to create the Third Generation Partnership Project (3GPP
– www.3gpp.org). These partners were: ETSI (EU), ANSI-TI (US), ARIB and
TTC (Japan), TTA (Korea), and CWTS (China). Basically, this was the group
of organisations backing UMTS and, since August 2000, when ETSI SMG
was dissolved, has been responsible for all standards work on UMTS.
3GPP have now completed the standardisation of the ﬁrst release of the
UMTS standards – Release 99 or R3. GSM upgrades have always been

24 AN INTRODUCTION TO 3G NETWORKS
known by the year of standardisation, and UMTS began to follow that
trend, until the Release 2000 got so behind schedule that it was broken
into two parts and renamed R4 and R5. In this chapter, only the completed
R3 (formally known as Release 99) will be described. Chapter 7 looks at
developments that R4 and R5 will bring. 3GPP standards can be found on
the 3GPP website – www.3GPP.org – and now completely specify the
components and the interfaces between them that constitute a UMTS
system.
† 3GPP2 – 3GPP2 (www.3gpp2.org) is the cdma2000 equivalent of 3GPP –
with ARIB and TTC (Japan), TR.45 (US), and TTA (Korea). It is currently
standardising cdma2000 based on evolution from the cdmaOne system
and using an evolved US D-AMPS network core. (The latter part of this
chapter gives an account of packet transfer in cdma2000.)
† ITU – The International Telecommunications Union (ITU – www.itu.int)
was the originating force behind 3G with the FLMTS concept
(pronounced Flumps and short for Future Land Mobile Telecommunica-
tion System) and work towards spectrum allocations for 3G at the World
Radio Conferences. The ITU also attempted to harmonise the 3GPP and
3GPP2 concepts, and this work has resulted in these being much more
closely aligned at the air interface level. Currently, the ITU is just begin-
ning to develop the concepts and spectrum requirements of 4G, a subject
that is discussed at length in Chapter 7.
† IETF – The Internet Engineering Task Force (www.ietf.org) is a rather differ-
ent type of standards organisation. The IETF does not specify whole archi-
tectural systems, rather individual protocols to be used as part of
communications systems. IETF protocols such as SIP (Session Initiation
Protocol) and header compression protocols have been incorporated in to
the 3GPP standards. IETF meetings take place three times a year and are
completely open, very large (20001 delegates), and very argumentative
(compared with the ITU meeting, say). Anyone can submit an Internet
draft to one of the working groups, and this is then open to comments. If it
is adopted, it becomes a Request For Comments (RFC); if not, it is not
considered any further.
† OHG – The Operator Harmonization Group [3] proposed, in June 1999, a
harmonised Global Third Generation concept [4] that has been accepted
by both 3GPP and 3GPP2. The OHG has attempted to align the air inter-
face parameters of the two standards, as far as possible, and to deﬁne a
generic protocol stack for interworking between the evolved core
networks of GSM and ANSI-41 (used in US 2G networks).
† MWIF – The industry pressure group Mobile Wireless Internet Forum
(www.mwif.org) comprises operators, manufacturers, ISPs (Internet
Service Providers) and Internet equipment suppliers. MWIF, since early
2000, has been producing a functional architecture that separates the
various components of a 3G systems – for example, the access technology

HISTORY OF 3G 25
– to provide opportunities for IP technologies such as Wireless LANs to be
used.
† 3GIP – 3GIP (www.3gip.org) was formed in May 1999 as a private pres-
sure group of operators and manufacturers – BT and AT&T were leading
members – with the aim of developing the core network of UMTS to
incorporate the ideas and technologies of IP multimedia. 3GIP was
born out of a desire to rapidly bring UMTS into the Internet era and was
initially successful in raising awareness of the issues. However, for 3GIP
contributions to have signiﬁcant inﬂuence within 3GPP, it was necessary
for the organisation to offer open membership in 2000. 3GIP has been
very inﬂuential on 3GPP, whilst speciﬁcations for the second release of
UMTS are still being developed.
† ETSI – ETSI (the European Telecommunications Standards Institute) is a
non-proﬁt-making organisation for telecommunications standards devel-
opment. Membership is open and currently stands at 789 members from
52 countries inside and outside Europe. ETSI is responsible for DECT and
HIPERLAN/2 standards developments as well as GSM developments.
2.3 History of 3G
It is not widely known that 3G was conceived in 1986 by the ITU (Interna-
tional Telephony Union). It is quite illuminating to trace the development of
the ideas and concepts relating to 3G from conception to birth. What is
particularly interesting, perhaps, is how the ideas have changed as they
have passed through different industry and standardisation bodies. 3G was
originally conceived as being a single world-wide standard and was origin-
ally called FLMTS (pronounced Flumps and short for Future Land Mobile
Telecommunication System) by the ITU. By the time it was born, it was quins
– ﬁve standards – and the whole project was termed the IMT-2000 family of
standards. After the ITU phase ended in about 1998, two bodies – 3GPP and
3GPP2 – completed the standardisation of the two ﬂavours of 3G that are
actually being deployed today and over the next few years (UMTS and
cdma2000, respectively). Meanwhile, these bodies, along with the Operator
Harmonisation Group (OHG), are looking at unifying these into a single 3G
standard that allows different air interfaces and networks to be ‘mixed and
matched’.
It is convenient to divide up the 3G gestation into three stages (trimesters):
† Pre-1996 – The Research Trimester.
† 1996–1998 – The IMT-2000 Trimester.
† Post-1998 – The Standardisation Trimester.
Readers interested in more details about the gestation of 3G should refer
to [5].

26 AN INTRODUCTION TO 3G NETWORKS
2.3.1 Pre-1996 – The Research Trimester
Probably the best description of original concept of 3G can be found in Alan
Clapton’s quote – head of BT’s 3G development at the time
‘‘3G …The evolution of mobile communications towards the goal of universal
personal communications, a range of services that can be anticipated being intro-
duced early in the next century to provide customers with wireless access to the
information super highway and meeting the ‘Martini’ vision of communications
with anyone, anywhere and in any medium.’’ [6]
Here are the major elements that were required to enable that vision:
† A world-wide standard – At that time, the European initiative was
intended to be merged with US and Japanese contributions to produce
a single world-wide system – known by the ITU as FLMTS. The vision was
a single hand-set capable of roaming from Europe to America to Japan.
† A complete replacement for all existing mobile systems – UMTS was
intended to replace all second generation standards, integrate cordless
technologies as well as satellite (see below) and also to provide conver-
gence with ﬁxed networks.
† Personal mobility – Not only was 3G to replace existing mobile systems,
but its ambition stretched to incorporating ﬁxed networks as well. Back in
1996, of course, ﬁxed networks meant voice, and it was predicted in a
European Green Paper on Mobile Communications [7] that mobile would
quickly eclipse ﬁxed lines for voice communication. People talked of
Fixed Mobile Convergence (FMC) with 3G providing a single bill, a single
number, common operating, and call control procedures. Closely related
to this was the concept of the Virtual Home Environment (VHE).
† Virtual Home Environment – The virtual home environment was where
users of 3G would store their preferences and data. When a user
connected, be it by mobile or ﬁxed or satellite terminal, they were
connected to their VHE, which then was able to tailor the service to the
connection and terminal being used. Before a user was contacted, the
VHE was interrogated, so that the most appropriate terminal could be
used, and the communication tailored to the terminals and connections
of the parties.
† Broadband service (2 Mbit/s) with on-demand bandwidth – Back in the
early 1990s, it was envisaged that 3G would also need to offer broadband
services – typically meaning video and video telephony. This broadband
requirement meant that 3G would require a new air interface, and this
was always described as broadband and typically thought to be 2 Mbit/s.
Associated with this air interface was the concept of bandwidth on
demand – meaning that it could be changed during a call. Bandwidth
on demand could be used, say, to download a ﬁle during a voice conver-
sation or upgrade to a higher-quality speech channel mid-way through a
call.

HISTORY OF 3G 27
† A network based on B-ISDN – Back in the early 1990s, another concept –
certainly at BT – was that every home and business would be connected
directly to a ﬁbre optic network. ATM transport and B-ISDN control would
then be used to deliver broadcast and video services, an example being
video on demand whereby customers would select a movie, and it would
be transmitted directly to their home. B-ISDN [Broadband ISDN was
supposed to be the signalling for a new broadband ISDN service based
on ATM transport – it was never actually developed, and ATM signalling is
still not yet sufﬁciently advanced to switch circuits in real time. ATM
(asynchronous transfer mode) is explained in the latter part of this chapter:
it is used in the UMTS radio access and core networks.] Not surprisingly,
given the last point, it was assumed that the 3G network would be based
on ATM/B-ISDN.
† A satellite component – 3G was always intended to have an integrated
satellite component, to provide true world-wide coverage and ﬁll in gaps
in the cellular networks. A single satellite/3G handset was sometimes
envisaged. (Surprisingly, since satellite handsets tend to be large).
The classic picture – seemingly compulsory in any description of 3G – is of a
layered architecture of radio cells (Figure 2.1). There are megacells for satel-
lites, macrocells for wide-area coverage (rural areas), microcells for urban
coverage, and picocells for indoor use. There is a mixture of public and private
use and always a satellite hovering somewhere in the background.
In terms of forming this vision of 3G, much of the early work was done in
the research programmes of the European Community, such as the RACE
(Research and development in Advanced Communications technologies in
Europe) programme with projects such as MONET (looking at the transport
and signalling technologies for 3G) and FRAMES (evaluating the candidate
air interface technologies). In terms of standards, ETSI (European Telecom-
munications Standards Institute) completed development of GSM phase 2,
and at the time, this was intended to be the ﬁnal version of GSM and for 3G
Figure 2.1 Classic 3G layer diagram.

28 AN INTRODUCTION TO 3G NETWORKS
to totally supersede it and all other 2G systems. As a result, European stan-
dardisation work on 3G, prior to 1996, was carried out within an ETSI GSM
group called, interestingly, SMG5 (Special Mobile Group).
2.3.2 1996–1998 – The IMT 2000 Trimester
It is now appropriate to talk of UMTS (Universal Mobile Telecommunications
System) – as the developing European concept was being called. In the case
of UMTS, the Global Multimedia Mobility report [8] was endorsed by ETSI
and set out the framework for UMTS standardisation. The UMTS Forum – a
pressure group of manufacturers and operators – produced the inﬂuential
UMTS forum report (www.umts-forum.org) covering all non-standardisation
aspects in UMTS such as regulation, market needs and spectrum require-
ments. As far as UMTS standardisation was concerned, ETSI transferred the
standardisation work from SMG5 to the various GSM groups working on the
air interface, access radio network, and core network.
In Europe, there were ﬁve different proposals for the air interface – most
easily classiﬁed by their Medium Access Control (MAC) schemes – in other
words, how they allowed a number of users to share the same spectrum.
Basically, there were time division (TDMA – Time Division Multiple Access),
frequency division (OFDM – Orthogonal Frequency Division Multiple
Access), and code division proposals (CDMA). In January 1998, ETSI
chose two variants of CDMA – Wideband CDMA (W-CDMA) and time
division (TD-CDMA) – the latter basically a hybrid with both time and
code being used to separate users. W-CDMA was designated to operate in
paired spectrum [a band of spectrum for up link and another (separated)
band for down link] and is referred to as the FDD (Frequency Division
Duplex) mode, since frequency is used to differentiate between the up and
down trafﬁc. In the unpaired spectrum, a single monolithic block of spec-
trum, the TD-CDMA scheme was designated, and this has to use time slots to
differentiate between up and down trafﬁc (FDD will not work for unpaired
spectrum – see Section 2.4 for more details), and so is called the TDD (Time
Division Duplex) mode of UMTS.
In comparison, GSM is a FDD/TDMA system – frequency is used to sepa-
rate up and down link trafﬁc, and time division is used to separate the
different mobiles using the same up (or down) frequency.
Part of the reason behind the decision to go with W-CDMA for UMTS was
to allow harmonisation with Japanese standardisation.
Unfortunately, in North America, the situation was more complicated;
ﬁrstly, parts of the 3G designated spectrum had been licensed to 2G opera-
tors and other parts used by satellites; secondly, the US already has an
existing CDMA system called cdmaOne that is used for voice. It was felt
that a CDMA system for North America needed to be developed from
cdmaOne – with a bit rate that was a multiple of the cdmaOne rate. Conse-
quently, the ITU recognised a third CDMA system – in addition to the two

HISTORY OF 3G 29
European systems – called cdma2000. It was also felt that the lack of 3G
spectrum necessitated an upgrade route for 2G TDMA systems – resulting in
a new TDMA standard – called UMC-136, which is effectively identical to a
proposed enhancement to GSM called EDGE (Enhanced Data rates for
Global Evolution). This takes advantage of the fact that the signal-to-noise
ratio (and hence potential data capacity) of a TDMA link falls as the mobile
moves away from the base station. Users close to base stations essentially
have such a good link that they can increase their bit rate without incurring
errors. By using smaller cells or adapting the rate to the signal-to-noise ratio,
on average, the bit rate can be increased. In CDMA systems, the signal-to-
noise ratio is similar throughout the cell.
Finally the DECT (Digital European Cordless Telecommunications) –
developed by ETSI for digital cordless applications and used in household
cordless phones, for example – inhabits the 3G spectrum and has been
included as the ﬁfth member of the IMT-2000 family of 3G standards
(Table 2.1) as the ITU now called the FPLMTS vision.
During this period, 3G progressed from its ‘Martini’ vision – ‘anytime,
anyplace, anywhere’, to a system much closer, in many respects, to the
existing 2G networks. It is true that the air interface was a radical change
from TDMA – it promised a better spectral efﬁciency, bandwidth on demand,
and broadband connections – but the core networks chosen for both UMTS
and cdma2000 were based on existing 2G networks: in the case of UMTS,
an evolved GSM core, and for cdma2000, an evolved ANSI-41 core (another
time division circuit switching technology standard). The major reason for
this was the desire by the existing 2G operators and manufacturers to reuse
as much existing equipment, development effort, and services as possible.
Another reason was the requirement for GSM to UMTS handover, recognis-
ing that UMTS coverage will be limited in the early years of roll-out.
The radio access network for UMTS was also new, supporting certain
technical requirements of the new CDMA technology and also the resource
management for multimedia sessions. The choice of evolved core network
for UMTS is probably the key non-IP friendly decision that was taken at this
time, meaning that that UMTS now supports both IP and X25 packets using a
common way of wrapping them up and transporting them over an under-
lying IP network. (X25 is an archaic and heavyweight packet switching
technology that pre-dates IP and ATM). In the meantime, X25 has become
Table 2.1 IMT 2000 family of 3G standards
IMT2000 designation Common term Duplex type
IMT-DS Direct Sequence CDMA Wideband CDMA FDD
IMT-MC Multi Carrier CDMA Cdma2000 FDD
IMT-TD Time Division CDMA TD/CDMA TDD
IMT-SC Single Carrier UMC-136 (EDGE) FDD
IMT-FT Frequency Time DECT TDD

30 AN INTRODUCTION TO 3G NETWORKS
totally defunct as a packet switching technology, and IP has become ubiqui-
tous, meaning that IP packets are wrapped up and carried within outer IP
packets because of a no-longer useful legacy requirement to support X25.
2.3.3 1998 Onwards – The Standardisation Trimester
After 1998, the function of developing and ﬁnalising the standards for UMTS
and cdma2000 passed to two new standards bodies: 3GPP and 3GPP2,
respectively. These bodies have now completed the ﬁrst version (or release)
of the respective standards (e.g. R3 – formally known as Release 99 for
UMTS), and these are the standards that equipment is currently being
procured against for the systems currently on order around the world.
Current order numbers are UMTS 34, cdma2000 9, and EDGE 1 (number
of systems [9]).
2G systems have not stood still and are introducing higher-speed packet
data services (so-called 2.5G systems: the GSM 2.5G evolution is GPRS –
GSM Packet Radio System). These will offer either subscription or per-packet
billing and allow users to be ‘always on’ without paying a per-second charge
as they currently do for circuit-based data transfer. The new network
elements needed to add packet data to GSM are also needed for UMTS,
and details of these are given later in the chapter (for a good description of
GPRS, see [10]).
In early 2000, 3G license auctions raised £50 billion in the UK and
Germany, and many expected that services would be universally available
by 2002. That now looks unlikely with the major downturn in the telecoms
industry, the failure of WAP to take off in Europe, and technical delays over
the new air interfaces and terminals. After WAP was widely rejected because
of long connection times and software errors, many operators are using 2.5G
systems – such as GPRS – as a proving ground for 3G. NTT launched a
limited 3G service in Tokyo, in late 2001, with a few hundred handsets.
Most commentators now see 3G deployment held back until 2004 and
much site and infrastructure sharing to produce cost savings.
Since the ﬁrst UMTS Release, there has been work in groups like 3GIP to
be more revolutionary and include more IP (in its widest sense) in 3G. 3GIP
has produced a number of technical inputs to the second version of UMTS –
originally called Release 2000 but now broken into two releases, known as
R4 and R5 in the revised (so as to avoid the embarrassment of ﬁnishing
Release 2000 in 2002) numbering scheme. We shall look at what R4 and
R5 offer in Chapter 7.
Finally the operator harmonisation group and 3GPP/3GPP2 are working to
harmonise UMTS, cdma2000, and EDGE such that any of these air interfaces
and their associated access networks – or indeed a Wireless LAN network –
can be connected to either an IS-41 or evolved GSM core network. The ﬁnal
goal is a single speciﬁcation for a global 3G standard.

SPECTRUM – THE ‘FUEL’ OF MOBILE SYSTEMS 31
2.4 Spectrum – The ‘Fuel’ of Mobile Systems
Now is a good time to consider spectrum allocation decisions, as these have
a key impact on the 3G vision in terms of the services (e.g. bandwidth or
quality) that can be provided and the economics of providing them.
In any cellular system, a single transmitter can only cover a ﬁnite area
before the signal-to-noise ratio between the mobiles and base stations
becomes too poor for reliable transmission. Neighbouring base stations
must then be set up and the whole area divided into cells on the basis of
radio transmission characteristics and trafﬁc density. The neighbouring cells
must operate on a different frequency (e.g. GSM /D-AMPS) or different
spreading code (e.g. W-CDMA or cdmaOne; see Figure 2.2). Calls are
handed over between cells by arranging for the mobile to use a new
frequency, code or time slot. It is a great, but proﬁtable and very serious,
game of simulation and measurement to estimate and optimise the capacity
of different transmission technologies. For example, it was originally esti-
mated that W-CDMA would offer a 10-fold improvement in transmission
efﬁciency (in terms of bits transmitted per Hertz of spectrum) over TDMA
(Time Division Multiple Access – such as GSM and D-AMPS) – in practice,
this looks to be twofold at best.
In general terms, for voice trafﬁc, the capacity of any cellular system is
given by:
K Spectrum ðkHzÞ Efficiency ðbps=kHzÞ Density=ðcells=km2 Þ
Capacity ðusers=km2 Þ ¼ ;
call bandwidth ðbpsÞ
The constant (K) depends on the precise trafﬁc characteristics – how often
users make calls and how long they last as well as how likely they are to
move to another base station and the quality desired – the chance of a user
Figure 2.2 Typical (TDMA) cellular system.

32 AN INTRODUCTION TO 3G NETWORKS
failing to make a call because the network is busy or the chance of a call
being dropped on handover.
Typically, ﬁgures for a 2G system are:
† Bandwidth of a call – 14 kbit/s (voice).
† Bandwidth available 30 MHz (Orange – UK).
† Efﬁciency 0.05 (or frequency reuse factor of 20 – meaning that one in 20
cells can use the same frequency with acceptable interference levels).
Now, there are several very clear conclusions that can be drawn from this
simple equation. First, any capacity can be achieved by simply building a
higher base station density (although this increases the costs). Second, the
higher the bandwidth per call, the lower the capacity – so broadband
systems offering 2 Mbit/s to each user need about 150 times the spectrum
bandwidth of voice systems to support the same number of users (or will
support around 150 times less users), all other things being equal. Third, any
major increase in efﬁciency – for a given capacity – means that either a
smaller density of base stations or less spectrum is required, and, given
both are very expensive, this is an important research area. Unfortunately
for 3G systems, as mentioned above, this factor has improved by only 2 over
current GSM systems. Finally if the bandwidth of a voice call can be halved,
the capacity of the system can be doubled; this is the basis of introducing
half-rate (7 kbit/s) voice coding in GSM.
So, given this analysis, it is hard to escape the conclusion that 3G systems
need a lot of spectrum. However, radio spectrum is a scarce resource. To
operate a cellular mobile system only certain frequencies are feasible: at
higher frequencies, radio propagation characteristics mean that the cells
become smaller, and costs rise. For example, 900-MHz GSM operators
(e.g. Cellnet in the UK) require about half the density of stations – in rural
areas – compared with 1800-MHz GSM operators like Orange. Also, above
about 3 GHz, silicon technology can no longer be used for the transmitters
and receivers – necessitating a shift to gallium arsenide technology, which
would be considerably more expensive. The difﬁculties of ﬁnding new spec-
trum in the 500–3000-MHz range should not be under-emphasised – see
[11] for a lengthy account of the minutiae involved – but, in short, all sorts of
military, satellite, private radio and navigation systems, and so forth all
occupy different parts of the spectrum in different countries. Making progress
to reclaim – or ‘re-farm’ as it is known – the spectrum is painfully slow on a
global scale. The spectrum bands earmarked for FPLMTS at the World Radio
Conference in 1992 were 1885–2025 MHz and 2110–2200 MHz – a total of
230 MHz. However, a number of factors and spectrum management deci-
sions have since eroded this allocation in practice:
† Mobile satellite bands consume 2 £ 30 MHz.
† In the US, licences for much of the FPLMTS band have already been sold
off for 2G systems.

UMTS NETWORK OVERVIEW 33
Figure 2.3 Global spectrum allocations for 3G (MSS bands are satellite spectrum).
† Part of the bands (1885–1900 MHz) overlap with the European DECT
system.
† The FPLMTS bands are generally asymmetrical (preventing paired spec-
trum allocations – see below).
All of this means that only 2 £ 60 MHz and an odd 15 MHz of unpaired
spectrum are available for 3G in Europe and much less in the US. The paired
spectrum is important – this means equal chunks of spectrum separated by a
gap – one part being used for up link communications and the other for
down link transmission. Without the gap separating them up and down link
transmissions would interfere at the base station and mobile if they trans-
mitted and received simultaneously. By comparison, in the UK today, 2 £
100 MHz is available for GSM, shared by four operators. Figure 2.3 shows
the general world position on the 3G spectrum – explaining why many
commentators expect 3G to be much less inﬂuential in the US and rolled
out earlier in Europe and Japan.
In the UK auction/licensing process, there were a dozen or so bidders
chasing ﬁve licences, resulting in three getting 10 MHz and two buying
15 MHz of paired spectrum per operator –BT has acquired 2 £ 10 MHz of
paired spectrum and 5 MHz of unpaired spectrum. BT Cellnet will use the
paired spectrum with 5 MHz for macrocells and 5 MHz for microcells –
there being no need for frequency planning in a W-CDMA system.
2.5 UMTS Network Overview
In order to illustrate the operation of a UMTS network, this section describes
a day in the life of a typical UMTS user – this sort of illustration is often called
a usage case or a scenario. The major network elements – the base stations

34 AN INTRODUCTION TO 3G NETWORKS
and switches etc. – will be introduced, as well as the functionally that they
provide. This at least has the merit of avoiding a very sterile list of the network
elements and serves as a high-level guide to the detailed description of
UMTS functionality that follows.
Mary Jones is 19 years old and has just arrived at the technical Polytechnic
of Darmstadt. She is lucky that her doting father has decided to equip her
with a 3G terminal before allowing her to live away from home – but then
this is 2004, and such terminals are now common in Germany and much of
Europe.
Mary ﬁrst turns her terminal on after breakfast and is asked to enter her
personal PIN code. This actually authenticates her to the USIM (UMTS
Subscriber Identity Module) – a smart card that is present within her terminal.
The terminal then searches for a network, obtains synchronisation with a
local base station, and, after listening to the information on the cell’s broad-
cast channel, attempts to attach to the network. Mary’s subscription to T-
Nova is based on a 15-digit number (which is not her telephone number)
identifying the USIM inside her terminal. This number is sent by the network
to a large database – called the home location register (HLR) located in the T-
Nova core network. Both the HLR and Mary’s USIM share a 128-bit secret
key – this is applied by the HLR to a random number using a one-way
mathematical function (one that is easy to compute but very hard to invert).
The result and the random number are sent to the network, which challenges
Mary’s USIM with the random number and accepts her only if it replies with
the same result as that sent from the HLR (Figure 2.4).
After attaching to the network, Mary decides to call her dad – perhaps,
although unlikely, to thank him for the 3G terminal. The UMTS core network
is divided into two halves – one half dealing with circuit-switched (constant
bit rate) calls – called the circuit-switched domain – and the other – the
packet-switched domain – routing packets sessions. At this time, Mary
attempts to make a voice call, and her terminal utilises the connection
management functions of UMTS. First, the terminal signals to the circuit
switch that it requires a circuit connection to a particular number – this
switch is an MSC (mobile switching centre). The MSC has previously down-
loaded data from the HLR when Mary signed on, into a local database called
the visitor location register (VLR) and so knows if she is permitted to call this
number, e.g. she may be barred from international calls. If the call is possi-
ble, the switch sets up the resources needed in both the core and radio
access networks. This involves checking whether circuits are available at
the MSC and also whether the radio access network has the resources to
support the call. Assuming that the call is allowed and resources are avail-
able, a constant bit rate connection is set up from the terminal, over the air
interface, and across the radio access network to the MSC – for mobile voice,
this will typically be 10 kbit/s or so. Assuming that Mary’s dad is located on
the public ﬁxed network, the MSC transcodes the speech to a ﬁll a 64 kbit/s
speech circuit (the normal connection for ﬁxed network voice) and trans-

UMTS NETWORK OVERVIEW 35
Figure 2.4 UMTS Architecture.
ports this to a gateway switch (the gateway MSC – GMSC) to be switched into
the public ﬁxed telephone network.
When the call ends, both the MSC and GMSC are involved in producing
Call Detail Records (CDR), with such information as: called and calling party
identity, resources used, time stamps, and element identity. The CDRs are
forwarded to a billing server where the appropriate entry is made on Mary’s
billing record.
Mary leaves her terminal powered on – so that it moves from being Mobi-
lity Management (MM)-connected to being MM-idle (when it was turned off
completely, it was MM-detached). Mary then boards a bus for the Polytech-
nic and passes the radio coverage of a number of UMTS base stations. In
order to avoid excessive location update messages from the terminal, the
system groups large numbers of cells into a location area. The location area
identiﬁer is broadcast by the cells in the information they broadcast to all
terminals. If Mary’s terminal crosses into a new location area, a location
update message is sent by the terminal to the MSC and also stored in the HLR.
When Tom tries to call Mary – he is ringing from another mobile network –
his connection control messages are received by the T-Nova GMSC. The
GMSC performs a look-up in the HLR, using the dialled number (i.e. Mary’s
telephone number) as a key – this gives her current serving MSC and location
area, and the call set-up request is forwarded to the serving MSC. Mary’s
terminal is then paged within the location area – in other words, all the cells

36 AN INTRODUCTION TO 3G NETWORKS
in that area request Mary’s terminal to identify the cell that it is currently in.
The terminal can remain in the MM-idle state, listening to the broadcast
messages and doing occasional location area updates without expending
very much energy.
Mary and Tom begin a conversation, but as Mary is still on the bus, the
network needs to hand over the connection from one base station to another
as she travels along. In CDMA systems, however, terminals are often
connected to several cells at once, especially during handover – receiving
multiple copies of the same bits of information and combining them to
produce a much lower error rate than would be the case for a single radio
connection. When the handover is achieved by having simultaneous
connections to more than one base station it is called soft-handover, and
in UMTS, the base stations connected to the mobile are known as the active
set.
Mary attends her ﬁrst lecture of the day on relativity and is slightly
confused by the concept of time dilation – she decides to browse the Internet
for some extra information. Before starting a browsing session, her terminal is
in the PMM (Packet Mobility Management) idle state – in order to send or
receive packets, the terminal must create what is called a PDP (packet data
protocol) context. A PDP context basically signals to the SGSN and GGSN
(Serving GPRS Support Node and Gateway GPRS Support node) – which are
the packet domain equivalent of the MSC and GMC switches – to set up the
context for a packet transfer session. What this means is that Mary’s terminal
acquires an IP address, the GSNs are aware of the Quality of service
requested for the packet session and that they have set up some parts of
the packet transfer path across the core network in advance. Possible QoS
classes for packet transfer, with typical application that might use them, are:
conversational (e.g. voice), streaming (e.g. streamed video), interactive (e.g.
web browsing) and background (ﬁle transfer). (All circuit-switched connec-
tions are conversational.) Once Mary has set up a PDP context, the Session
Management (SM) state of her terminal moves from inactive to active.
When Mary actually begins browsing, her terminal sends a request for
resources to send the IP packet(s) and, if the air interface, radio access, and
core networks have sufﬁcient resources to transfer the packet within the QoS
constraints of the interactive class, the terminal is signalled to transmit the
packets. Mary is able to ﬁnd some useful material and eventually stops
browsing and deactivates her PDP context when she closes the browser
application.
During the afternoon lecture, Mary has her 3G terminal set to divert
incoming voice calls to her mail box. Tom tries to ring her and is frustrated
by the voice mail – having some really important news about a party that
evening. He sends her an e-mail of high priority. When this message is
received by the T-Nova gateway, it is able look in the HLR and determine
that Mary is attached to the network but has no PDP context active – it also
only knows her location for packet services within the accuracy of a Routing

UMTS NETWORK DETAILS 37
Area (RA). This is completely analogous to the circuit-switched case, and a
paging message is broadcast, requesting Mary’s terminal to set up a PDP
context so that the urgent e-mail can be transferred. Mary is, of course, able
to ﬁlter incoming e-mails to prevent junk mail causing her terminal to be
notiﬁed – after all, she is paying for the transfer of packets from the gateway.
This scenario has brieﬂy looked at the elements within the UMTS R3
network and how they provide the basic functions of: security, connection
management, QoS, mobility management and transport of bits for both the
circuit and packet-switched domains. The next section goes into greater
detail and expands on some of these points (especially those relating to
the packet domain, since this will be contrasted with IP procedures in the
next few chapters).
So far, little has been said about the role of the Radio Access Network and
the air interface. The Radio Access Network (RAN) stretches from the base
station, through a node called the Radio Network Controller, to the SGSN/
MSC. The RAN is responsible for mobility management – nearly all terminal
mobility is hidden from the core network being managed by the RAN. The
RAN is also responsible for allocating the resources across the air interface
and within the RAN to support the requested QoS.
2.6 UMTS Network Details
In order to avoid a lengthy description of all ﬁve 3G systems, the UMTS
(Universal Mobile Telecommunications System), a European/Japanese
member of the IMT-2000 family, will be mostly followed.
The UMTS air interface will not be detailed to any great length, because
there are plenty of books and papers already describing it in great detail[12],
and, to a network designer at least, it is a highly detailed subject that has only
a limited effect on the network (and, ultimately, the arguments about IP in
3G).
It is convenient to break 3G networks into an architecture (what the build-
ing blocks (switching centres, gateways…) are and how they are connected
(interfaces)) and four functions that are distributed across the architecture:
† Transport – How the bits are routed/switched around the network.
† Security – How users are identiﬁed, authorised, and billed.
† Quality of Service – How users obtain a better than best-effort service.
† Mobility management – The tracking of users and handover of calls
between cells.
The PSTN could be easily broken down in this way – mobility manage-
ment would be reduced to a cordless phone. However, the building blocks
would be the terminal, local exchange and main switching centre. The bits
would be transported by 64 kbit/s switching technology from the exchange
level, and quality would be provided by provisioning using Erlang’s formula,
yielding either 64 kbit/s or nothing. Finally, phones are identiﬁed by an E164

38 AN INTRODUCTION TO 3G NETWORKS
number (01473…), and being named on the contract with the phone
company makes the user responsible for all call charges – the phone is
secured by the user’s locked front door.
Since this is a book about IP – and also because future network evolutions
will use IP to carry all trafﬁc, including voice – we will largely concentrate on
the packet data domain in 3G networks.
2.6.1 UMTS Architecture – Introducing the Major Network Elements and their
Relationships
UMTS is divided into three major parts: the air interface, the UMTS Terres-
trial Radio Access Network (UTRAN), and the core network. The ﬁrst release
of the UMTS network (Figure 2.5) – R3, the Release previously known as R99
– consists of an enhanced GSM phase 2 core network (CN) and a wholly new
radio access network (called the UMTS Terrestrial Radio Access Network or
UTRAN).
For readers familiar with the GSM, the MSC, G-MSC, HLR, and VLR (see
Further reading for more information on GSM) are simply the normal GSM
components but with added 3G functionality. The UMTS RNC (Radio
Network Controller) can be considered to be roughly the equivalent of the
Base Station Controller (BSC) in GSM and the Node Bs equate approximately
to the GSM base stations (BTSs – Base Transceiver Stations).
Figure 2.5 UMTS R3 (Release 99) Architecture.

UMTS NETWORK DETAILS 39
The RNCs and base stations are collectively known as the UTRAN (UMTS
Terrestrial Radio Access Network). From the UTRAN to the Core, the
network is divided into packet and circuit-switched parts, the Interface
between the radio access and core network (Iu) being really two interfaces:
Iu(PS – Packet switched) and Iu(CS – circuit-switched). Packet trafﬁc is
concentrated in a new switching element – the SGSN (Serving GPRS Support
Node). The boundary of the UMTS core network for packets is the GGSN
(Gateway GPRS Support Node), which is very much like a normal IP gateway
and connects to corporate Intranets or the Internet.
Below is a quick guide to some of the functionality of each of these
elements and interfaces:
† 3G Base Station (Node B) – The base station is mainly responsible for the
conversion and transmission/reception of data on the air interface (Uu)
(Figure 2.5) to the mobile. It performs error correction, rate adaptation,
modulation, and spreading on the air interface. Each Node B may have a
number of radio transmitters and cover a number of cells. (The Node B
can achieve soft handover between its own transmitters (this is called
softer handover), the Node B also sends measurement reports to the RNC.
† RNC – The RNC is an ATM switch that can multiplex/demultiplex user
packet and circuit data together. Unlike in GSM, RNCs are connected
together (through the Iur interface) and so can handle all radio resourcing
issues autonomously. Each RNC controls a number of Node Bs – the
whole lot being known as an RNS – Radio Network System. The RNC
controls congestion and soft handover (involving different Node Bs) as
well as being responsible for operation and maintenance (monitoring,
performance data, alarms, and so forth) within the RNS.
† SGSN – The SGSN is responsible for session management, producing
charging information, and lawful interception. It also routes packets to
the correct RNC. Functions such as attach/detach, setting up of sessions
and establishing QoS paths for them are handled by the SGSN.
† GGSN – A GGSN is rather like an IP gateway and border router – it
contains a ﬁrewall, has methods of allocating IP addresses, and can
forward requests for service to corporate Intranets (as in dial-up Internet/
Intranet connections today). GGSNs also produce charging records.
† MSC – The Mobile Switching Centre/Visitor Location Register handles
connection-orientated circuit switching responsibilities including
connection management (setting up the circuits) and mobility manage-
ment tasks (e.g. location registration and paging). It is also responsible for
some security functions and Call Detail Record (CDR) generation for bill-
ing purposes.
† GMSC – The Gateway MSC deals with incoming and outgoing connec-
tions to external networks (such as the public ﬁxed telephony network) for
circuit-switched trafﬁc. For incoming calls, it looks up the serving MSC by
querying the HLR and sets up the connection the MSC.

40 AN INTRODUCTION TO 3G NETWORKS
† HLR – The home location register, familiar from GSM, is just a large
database with information about users, their services (e.g. whether they
are pre- or post-pay, whether they have roaming activated, and the QoS
classes to which they have subscribed). Clearly, new ﬁelds have been
added for UMTS – especially relating to data services.
Let us just sketch out the scale of a possible network, taking the UK as an
example, – to gain a better feel of what it looks like on the ground. First, the
Node Bs are the transmitters and will be located in many of the places that
GSM transmitters are currently located (site sharing on churches and so forth)
– there will also be new sites needed. Many thousands of base stations will be
needed to cover 50% of the UK (for example). A short link (maybe microwave)
of a mile or so will link the node Bs into something like a local exchange where
leased lines connect them to RNCs in regional centres – there will be only tens
of RNCs. The RNCs are then connected to an SDH ring that is also connected
to SGSNs and GGSNs. There will be very few SGSNs, and they will probably
be co-located with GGSNs in one or more major centres (combined SGSNs
and GGSNs will be available). It is also possible to reuse GSM MSCs and GSNs
by upgrading them for 3G. However, many operators will not want to disturb
existing systems and will install new 3G MSCs and SGNs – although these will
be co-located with their 2G equivalents.
2.6.2 UMTS Security
Security in a mobile network covers a wide range of possible issues affecting
the supply of and payment for services. Typical security threats and issues
might be:
† Authentication – Is the person obtaining service the person who he/she
claims to be?
† Authorisation – are they authorised to use this service?
† Conﬁdentiality of data – Is anyone eavesdropping on the user’s data/
conversations?
† Conﬁdentially of location – Can anybody discover the user’s location
without authorisation?
† Denial of service – Can anybody deny the user service (e.g. sending false
update messages about the user’s terminal location) to prevent them
obtaining some service? An example of this might be when a user is
bidding in an auction, and other bidders wish to prevent that user from
continuing to bid against them.
† Impersonation – Can users take other users’ mobile identities – and gain
free service, or access to other users’ information? Can sophisticated
criminals set up false base stations that collect information about users
or their data?